Computer system having an authentication and/or authorization routing service and a CORBA-compliant interceptor for monitoring the same

Abstract

A CORBA-compliant computer network includes a registration server on which an AAR service resides, a registry database and an ORB which couples the registry server to the registry database. A CORBA-compliant interceptor residing on the ORB intercepts each message, generated by the AAR service, invoking the registry database and each message, generated by the registry database, responding to the invocation message generated by the service of the client server. The interceptor selects information useful in determining the cause of a failed usage of the service residing in the client server from each intercepted invocation and response messages, writes the selected information to a data store residing in the client server and then re-invokes the intercepted invocation and response messages. In the event of a network failure, the data written to the data store may be reviewed to obtain useful information regarding the network failure.

1. A CORBA-compliant computer network, comprising:
 a first server having a first service residing therein;  
 a second server having a second service and a first data store residing therein;  
 a database;  
 a first ORB having first client-side and target-side CORBA-compliant interceptors residing therein, said first server and said database coupled to said second server through said first ORB;  
 said first client side CORBA-compliant interceptor intercepting: 
 (1) messages generated by said second service when invoking said first service as a target of said second service;  
 (2) messages generated by said second service when invoking said database as a target of said second service;  
 (3) messages generated by said first service when responding to said invocation messages generated by said second service; and  
 (4) messages generated by said database when responding to said invocation messages generated by said second service;  
 
 said first target-side CORBA-compliant interceptor intercepting: 
 (1) messages generated by said first service when invoking said second service as a target of said first service; and  
 (2) messages generated by said second service when responding to said invocation messages generated by said first service;  
 
 said first client-side and target-side CORBA-compliant interceptors selecting, from each said intercepted invocation and response message, information useful in determining a cause of a failed usage of said second service, writing said selected information from each said intercepted invocation and response message to said first data store residing in said second server and re-invoking each said intercepted invocation and response message,  
 a third server having a third service, a fourth service and a second data store residing therein;  
 a second ORB having second and third client-side and second and third target-side CORBA-compliant interceptors residing therein, said first server, said second server and said database coupled to said third server through said second ORB;  
 said second client side CORBA-compliant interceptor intercepting: 
 (1) messages generated by said third service when invoking said first service as a target of said third service;  
 (2) messages generated by said third service when invoking said database as a target of said third service;  
 ( 3 ) messages generated by said first service when responding to said invocation messages generated by said third service; and  
 (4) messages generated by said database when responding to said invocation messages generated by said third service;  
 
 said second target-side CORBA-compliant interceptor intercepting: 
 (1) messages generated by said first service when invoking said third service as a target of said first service; and  
 (2) messages generated by said third service when responding to said invocation messages generated by said first service;  
 
 said third client-side CORBA-compliant interceptor intercepting: 
 (1) messages generated by said fourth service when invoking said first service as a target of said fourth service;  
 (2) messages generated by said fourth service when invoking said second service as a target of said fourth service;  
 (3) messages generated by said first service when responding to said invocation messages generated by said fourth service; and  
 (4) messages generated by said second service when responding to said invocation messages generated by said fourth service;  
 
 said third target-side CORBA-compliant interceptor intercepting: 
 (1) messages generated by said first service when invoking said fourth service as a target of said first service;  
 (2) messages generated by said fourth service when responding to said invocation messages generated by said first service;  
 (3) messages generated by said second service when invoking said fourth service as a target of said second service; and  
 (4) messages generated by said fourth service when responding to said invocation messages generated by said second service;  
 
 each one of said second and third client-side CORBA-compliant interceptors and said second and third target-side CORBA-compliant interceptors selecting, from each said invocation and response message intercepted thereby, information useful in determining a cause of a failed usage of said third and fourth services, writing said selected information from each said intercepted invocation and response message to said second data store residing in said third server and re-invoking each said invocation and response message intercepted thereby.  
 
   
   
     2. The computer network of  claim 1 , wherein:
 said first server is an access server, said first service is an access service, said second server is a registry server, said second service is an AAR service, and said database is a registry database; and  
 said first data store residing in said registry server maintaining data derived from each message generated in connection with the invocation of: 
 (1) said access service as said a target of said AAR service;  
 (2) said registry database as a target of said AAR service;  
 (3) said AAR service as a target of said access service.  
 
 
   
   
     3. The computer network of  claim 1 , wherein:
 said first server is an access server, said first service is an access service, said second server is a first registry server, said second service is a first AAR service, said third server is a second registry server, said third service is a second AAR service, said fourth service is a SM service and said database is a registry database; and  
 said first data store residing in said first registry server maintaining data derived from each message generated in connection with the invocation of: 
 (1) said access service as a target of said first AAR service;  
 (2) said registry database as a target of said first AAR service;  
 (3) said SM service as a target of said first AAR service; and  
 (4) said first AAR service as a target of said access service;  
 
 said second data store residing in said second registry server maintaining data derived from each message generated in connection with the invocation of: 
 (1) said access service as a target of said second AAR service;  
 (2) said registry database as a target of said second AAR service;  
 (3) said SM service as a target of said second AAR service;  
 (4) said second AAR service as a target of said access service;  
 (5) said access service as a target of said SM service; and  
 (6) said SM service as a target of said access service.  
 
 
   
   
     4. The computer network of  claim 3 , wherein said information selected from each intercepted exchange between:
 (1) said AAR services of said first registry server and said registry database;  
 (2) said AAR services of said first registry server and said access server;  
 (3) said AAR services of said first registry server and said SM service of said second registry server;  
 (4) said AAR services of said second registry server and said registry database;  
 (5) said AAR services of said second registry server and said access server; and  
 (6) said AAR services of said second registry server and said SM service of said second registry server;  
 identifies:  
 (1) a user for which said AAR service is being utilized;  
 (2) a destination of said intercepted exchange;  
 (3) the time of interception; and  
 (4) whether said intercepted exchange had been successfully routed between an originating device and the destination.  
 
   
   
     5. The computer network of  claim 4 , further comprising:
 a web server having a runtime service residing therein, said web server coupled to the second registry server through said second ORB;  
 said third target-side CORBA-compliant interceptor further intercepting messages generated by said runtime service when invoking said SM service of said registry server.  
 
   
   
     6. A computer-implemented method for troubleshooting a multi-tiered secured computer network having a first plurality of web servers, each having a runtime service residing therein, and a second plurality of access servers, each having an access service residing therein, in a first, extranet, tier and a third plurality of registry servers and a registry database in a second, intranet, tier, a first one of said third plurality of registry servers having an SM service, an AAR service and a data store residing therein and remaining ones of said third plurality of registry servers each having an AAR service and a data store residing therein, comprising:
 use of at least one CORBA-compliant interceptor for the following intercepting actions:  
 intercepting all exchanges between said registry database and each said AAR service of said third plurality of registry servers;  
 for each intercepted exchange between said registry database and each said AAR service of said third plurality of registry servers, recording selected data regarding said exchange in said data store of a registry server in which said AAR service involved in said exchange resides;  
 intercepting all exchanges between each said AAR service of said third plurality of registry servers and each said access service of said second plurality of access servers;  
 for each intercepted exchange between each said AAR service of said third plurality of registry servers and each said access service of said second plurality of access servers, recording selected data regarding said exchange in said data store of said registry server in which said AAR service involved in said exchange resides;  
 intercepting all exchanges between said SM service of a first registry server and each said AAR service of said third plurality of registry servers;  
 for each intercepted exchange between said SM service of said first registry server and each said AAR service of said third plurality of registry servers, recording selected data regarding said exchange in said data store of said first registry server;  
 intercepting all exchanges between said SM service of said first registry server and each said runtime service of said first plurality of web servers;  
 for each intercepted exchange between said SM service of said first registry server and each said runtime service of said first plurality of web servers, recording selected data regarding said exchange in said data store of said first registry server;  
 reviewing said selected data recorded at one or more of said third plurality of registry servers to obtain useful information regarding a failure of said computer network; and  
 troubleshooting said failure of said computer network using said useful information obtained during said reviewing.  
 
   
   
     7. The method of  claim 6 , wherein recording, for each intercepted exchange between said registry database and each said AAR service of said third plurality of registry servers and between each said AAR service of said third plurality of registry servers and said second plurality of access servers, selected data regarding each said exchange in said data store of said registry server in which said AAR service involved in said exchange resides further comprises recording the identity of the user requesting authentication/authorization, the destination of said exchange, the time of interception of said exchange and whether said exchange was successfully routed. 
   
   
     8. The method of  claim 7 , wherein recording, for each said intercepted exchange between said SM service of said first registry server and each said AAR service of said third plurality of registry servers and between said SM service of said first registry server and each said logtime service of said first plurality web servers, selected data regarding said exchange in said data store of said first registry server further comprises recording the identity of the user engaged in a session to which said exchange relates, the destination of said exchange, the time of interception of said exchange and whether said exchange was successfully routed.